3.5. Investigate Microsoft 365 Activities
💡 First Principle: Microsoft 365 is where an organization's data lives, so it's where attackers and insiders go to read, copy, and send it. Three record types answer three different questions: what did users and admins do? (the audit log), what content exists and where? (Content search), and what did apps and scripts request through the API? (Microsoft Graph activity logs). An investigation usually needs all three.
Why care: business email compromise, data theft, and malicious app scenarios end with questions like "which emails did the attacker read?" or "did the OAuth app download files?" Answering them requires choosing the right log, knowing how long it's kept, and knowing whether it was even turned on before the incident.
The mental model is a building's records. The audit log is the security desk's sign-in book and CCTV: who entered which rooms and when. Content search is the filing system: it finds documents by what they say, but doesn't record who opened them. Graph activity logs are the records of the mail and delivery service: every request made by machines and apps on someone's behalf.
⚠️ Common Misconception: "Audit (Standard) keeps a year of records." Standard keeps 180 days; Premium keeps a year by default for Exchange, SharePoint, OneDrive, and Entra ID records, while other activity stays at 180 days unless a retention policy says otherwise. Two related traps: Content search can't tell you who accessed a file (that's audit), and Graph activity logs exist for investigation only if diagnostic settings exported them before the incident.
